Read the docs
TI-2026-83387 Aliases CVE-2026-62254

Excessive memory reallocation in LibreDWG DWG class decoding

Priority LOW 24CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

LibreDWG before 0.14 is affected. A specially crafted R13-R2000 DWG file makes decode_R13_R2000 in src/decode.c call realloc on every iteration of the class-decoding loop without checking num_classes, which causes resource exhaustion (CWE-400). An attacker who gets a user to parse a crafted file can cause a slow allocation loop and denial of service, without needing any privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed libredwg (LibreDWG): 0.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LibreDWGlibredwgbefore 0.140.14Patch availableCNA
  • libredwg VendorLibreDWG Affected before 0.14 Fixed in 0.14 Patch available CNA

Remediation

Upgrade libredwg to version 0.14, which fixes this issue. Running the parser in a sandbox with memory limits is a workaround rather than a remediation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA libredwg (LibreDWG) Fixed in 0.14

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62254
  2. 2026-10-30 CISA SSVC decision points changed
  3. 2026-10-30 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-83400 Const input modified and crash in LibreDWG bit_TV_to_utf8 CVSS 3.1LOW 3.3
  • TI-2026-83401 Unbounded allocation in LibreDWG pre-R13 DWG entity decoding CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences